Food fraud incident management

9.1 Purpose

Every organisation implementing this methodology must have a documented protocol for responding to the detection or reasonable suspicion of a food fraud incident. This protocol must be proportionate to the size and complexity of the organisation and integrated with the general incident management procedure of the FSMS.

9.2 Response protocol

On detection or reasonable suspicion of food fraud, the organisation must carry out the following phases:

Phase 1 — Immediate containment (0-24 hours)

1. Activate the VACCP team leader.
2. Hold and identify all potentially affected product/ingredient (quarantine).
3. Stop receiving new product from the suspect supplier (where applicable).
4. Preserve all available evidence (samples, documents, electronic records, communications).
5. Assess whether any affected product has already been distributed or sold.

Phase 2 — Investigation (24-72 hours)

1. Convene the VACCP team to assess the situation.
2. Carry out confirmatory analytical testing on the suspect product/ingredient.
3. Trace the origin of the affected product using the traceability system.
4. Determine the extent of the incident (lots, volumes, periods, destinations).
5. Identify the root cause and the point in the supply chain where the fraud occurred.
6. Document all findings.

Phase 3 — Communication and notification (according to findings)

1. Notify top management.
2. Assess the need to notify:
   • Competent authorities (according to the legal requirements of the jurisdiction).
   • Affected customers.
   • Certification body.
   • Consumers (where there is a risk to public health).
3. Where there is a risk to public health, activate the FSMS withdrawal/recall procedure.
4. Document all communications made.

Phase 4 — Corrective actions and closure (according to complexity)

1. Implement immediate corrective actions on the affected product/ingredient.
2. Take action regarding the supplier involved (suspension, extraordinary audit, termination of the relationship).
3. Reassess the vulnerability of the affected ingredient/product (update the scores).
4. Strengthen the countermeasures wherever weaknesses are identified.
5. Document the lessons learned.
6. Present a closure report on the incident to the VACCP team and top management.
7. Share relevant information (without confidential data) with the industry where appropriate.

The protocol, in motion

The same twenty-five actions, tickable. If you are managing an incident right now, whatever you tick is kept in this browser.

Checklist0 of 25

Phase 1 — Immediate containment

0-24 h

• Activate the VACCP team leader.
• Hold and identify all potentially affected product (quarantine).
• Stop receiving new product from the suspect supplier (where applicable).
• Preserve all available evidence: samples, documents, records, communications.
• Assess whether any affected product has already been distributed or sold.

Phase 2 — Investigation

24-72 h

• Convene the VACCP team to assess the situation.
• Carry out confirmatory analytical testing on the suspect product.
• Trace the origin of the affected product using the traceability system.
• Determine the extent of the incident: lots, volumes, periods, destinations.
• Identify the root cause and the point in the chain where the fraud occurred.
• Document all findings.

Phase 3 — Communication and notification

According to findings

• Notify top management.
• Assess notification to the competent authorities.
• Assess notification to affected customers.
• Assess notification to the certification body.
• Assess notification to consumers, where there is a risk to public health.
• Where there is a risk to public health, activate the FSMS withdrawal/recall procedure.
• Document all communications made.

Phase 4 — Corrective actions and closure

According to complexity

• Implement immediate corrective actions on the affected product.
• Take action regarding the supplier involved.
• Reassess the vulnerability of the affected ingredient and update the scores.
• Strengthen the countermeasures wherever weaknesses are identified.
• Document the lessons learned.
• Present a closure report to the VACCP team and top management.
• Share relevant information with the industry, where appropriate.

9.3 Incident records

A complete record must be kept of each incident, including as a minimum:

• Date and time of detection
• Affected product/ingredient
• Type of fraud suspected/confirmed
• Description of the finding
• Containment actions taken
• Results of the investigation
• Communications made
• Corrective actions implemented
• Vulnerability reassessment
• Closure date and lessons learned